Attackers behind a campaign distributing Locky ransomware via the Nuclear Exploit Kit have switched to distributing CryptXXX using the feature-laden Angler Exploit Kit.
Source: Threadpost